What you need to know
Authentication identifies the caller. Authorization decides whether that caller may read or change a specific resource. A signed-in user should not automatically be allowed to access every record.
How to apply it
Authenticate every protected request, then check ownership or role permissions for the requested object. Enforce the decision on the server even if the interface hides the action.
Common mistake to avoid
Do not rely on a hidden button or client-side role check. Attackers can call an API directly and change the resource identifier.